Cybersecurity Pentest Proposal

CYBERSECURITY PENETRATION TEST PROPOSAL

Parties and Proposal Date

Client Name:

Service Provider Name:

Proposal Effective Date:

Recitals

WHEREAS, Client engages Service Provider to conduct cybersecurity testing and related professional services as set forth in this Proposal; and

WHEREAS, Service Provider represents that it possesses the technical expertise, certification, tools and personnel necessary to perform penetration testing in accordance with industry standards and agreed scope; and

WHEREAS, the parties desire to set forth the scope, deliverables, schedule, fees and legal terms applicable to the engagement.

Scope of Work

Description of services to be performed. Service Provider shall perform a penetration test limited to the components and test types selected below, executed in a manner to minimize disruption to Client operations. The engagement shall include vulnerability discovery, exploitation where authorized, post-exploitation analysis, and remediation validation as set forth in this Proposal.

Testing Methodology & Deliverables

Service Provider will apply recognized testing methodologies, including active reconnaissance, authenticated and unauthenticated scanning, controlled exploitation, privilege escalation and post-exploitation analysis where authorized. Testing will conform to agreed time windows, rules of engagement and safe testing practices.

Network Infrastructure Web Application Mobile Application

Cloud Configuration Social Engineering (phishing)

Assumptions and Exclusions

Payment Terms

Total Fee:

Invoice Due Within (days):

Late Fee:

Term and Termination

Engagement Start Date:

Engagement End Date:

Either party may terminate this engagement for material breach if the breaching party fails to cure such breach within the notice period specified above, except that Client may terminate for convenience upon payment of all fees for work performed through the termination date.

Confidentiality

Each party shall maintain in strict confidence all Confidential Information disclosed by the other party in connection with this engagement. Confidential Information includes test results, exploitation details, evidence of vulnerabilities, remediation guidance, and any assessment reports. Confidential Information shall not be disclosed to any third party without the disclosing party's prior written consent except as required by law or to permitted contractors who are bound by equivalent confidentiality obligations.

Service Provider shall not publish or disclose any exploit details, proof-of-concept code, or raw evidence that would enable an exploit without Client's prior written consent. All deliverables marked as Confidential shall remain the sole property of Client for purposes of confidentiality.

Limitation of Liability & Indemnification

To the maximum extent permitted by law, the aggregate liability of Service Provider for claims arising out of this engagement shall not exceed the total fees actually paid by Client for the services provided under this Proposal. Neither party shall be liable for special, incidental, consequential or punitive damages, including loss of business or profits, even if advised of the possibility of such damages.

Client shall indemnify and hold harmless Service Provider from claims arising from Client's failure to obtain necessary permissions, from Client-supplied materials that introduce vulnerabilities, or from any misuse of deliverables by Client or third parties, except to the extent caused by Service Provider's willful misconduct or gross negligence.

Client Responsibilities

Change Orders

Any changes to scope, schedule or fees shall be documented in a written change order signed by authorized representatives of both parties. Change orders may adjust price, timeline and deliverables as necessary.

Governing Law

This Proposal and any resulting agreement shall be governed by and construed in accordance with the laws of the jurisdiction specified below, without regard to conflict of law principles.

Entire Agreement

This Proposal, together with any executed change orders or exhibits expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior discussions, proposals and agreements, whether written or oral. Any modifications must be in writing and signed by authorized representatives of both parties.

Acceptance

By signing below, the parties acknowledge that they have read, understand and agree to be bound by the terms of this Proposal and authorize Service Provider to proceed with the work described herein upon receipt of any required deposits.

Sign Now